@posthog/wizard 2.34.0 → 2.36.0

package/dist/{agent-interface-BcUv1qeh.js → agent-interface-CPn9pZ8j.js}

@@ -1,9 +1,9 @@
 import { n as __require } from "./rolldown-runtime-B_-DWIq7.js";
-import { J as WIZARD_ORCHESTRATOR_FLAG_KEY, L as POSTHOG_FLAG_HEADER_PREFIX, Q as WIZARD_USER_AGENT, V as POSTHOG_PROPERTY_HEADER_PREFIX, X as WIZARD_REMARK_EVENT_NAME, a as getLogFilePath, f as skillTmpPath, o as initLogFile, p as getUI, r as debug, rt as runtimeEnv, s as logToFile, u as WIZARD_YARA_REPORT_FILE } from "./debug-Cn4L5Ype.js";
-import { t as analytics } from "./analytics-DQ8IS1Hu.js";
-import { i as getLlmGatewayUrlFromHost } from "./urls-DAVzgHGZ.js";
-import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-CN55LYyZ.js";
-import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-DqeMgCVr.js";
+import { B as POSTHOG_PROPERTY_HEADER_PREFIX, L as POSTHOG_FLAG_HEADER_PREFIX, Y as WIZARD_REMARK_EVENT_NAME, Z as WIZARD_USER_AGENT, a as getLogFilePath, f as skillTmpPath, nt as runtimeEnv, o as initLogFile, p as getUI, q as WIZARD_ORCHESTRATOR_FLAG_KEY, r as debug, s as logToFile, u as WIZARD_YARA_REPORT_FILE } from "./debug-BpWrz3hX.js";
+import { t as analytics } from "./analytics-Be_wRgxD.js";
+import { t as HostResolution } from "./host-resolution-BD6TcZG0.js";
+import { n as ADDITIONAL_FEATURE_PROMPTS } from "./wizard-session-CqihOtk3.js";
+import { i as wizardAbort, n as registerCleanup, t as WizardError } from "./wizard-abort-t41wO4Bh.js";
 import { createRequire } from "node:module";
 import * as fs$1 from "fs";
 import fs from "fs";
@@ -13,9 +13,173 @@ import { spawnSync } from "node:child_process";
 import axios from "axios";
 import { z } from "zod";
 import fg from "fast-glob";
+import * as os from "os";
 import { execFileSync } from "child_process";
 import { randomUUID } from "crypto";
-import * as os from "os";
+//#region src/utils/custom-headers.ts
+/**
+* Builds a list of custom headers for ANTHROPIC_CUSTOM_HEADERS.
+*/
+function createCustomHeaders() {
+	const entries = [];
+	return {
+		add(key, value) {
+			const name = key.startsWith("x-") || key.startsWith("X-") ? key : `X-${key}`;
+			entries.push({
+				key: name,
+				value
+			});
+		},
+		addFlag(flagKey, variant) {
+			const headerName = POSTHOG_FLAG_HEADER_PREFIX + flagKey.toUpperCase();
+			entries.push({
+				key: headerName,
+				value: variant
+			});
+		},
+		encode() {
+			return entries.map(({ key, value }) => `${key}: ${value}`).join("\n");
+		}
+	};
+}
+//#endregion
+//#region src/lib/safe-tools.ts
+const LINTING_TOOLS = [
+	"codespell",
+	"cspell",
+	"git-diff-check",
+	"gitleaks",
+	"trufflehog",
+	"asl-validator",
+	"ansible-lint",
+	"pmd",
+	"biome",
+	"cfn-lint",
+	"cfnlint",
+	"checkov",
+	"trivy",
+	"test-aztemplate",
+	"shellcheck",
+	"shfmt",
+	"buildifier",
+	"cpplint",
+	"clang-format",
+	"clang-tidy",
+	"cmake-format",
+	"iwyu",
+	"pragma-once",
+	"dotnet-format",
+	"circleci",
+	"clj-kondo",
+	"coffeelint",
+	"commitlint",
+	"jscpd",
+	"stylelint",
+	"prettier",
+	"cue-fmt",
+	"dart",
+	"hadolint",
+	"dotenv-linter",
+	"editorconfig-checker",
+	"actionlint",
+	"zizmor",
+	"gofmt",
+	"gofumpt",
+	"goimports",
+	"gokart",
+	"golangci-lint",
+	"golines",
+	"semgrep",
+	"goreleaser",
+	"graphql-schema-linter",
+	"npm-groovy-lint",
+	"haml-lint",
+	"htmlhint",
+	"djlint",
+	"checkstyle",
+	"google-java-format",
+	"eslint",
+	"next lint",
+	"deno",
+	"rome",
+	"eslint-plugin-jsonc",
+	"eslint-plugin-json",
+	"eslint-plugin-jsx-a11y",
+	"eslint-plugin-react",
+	"nbqa",
+	"detekt",
+	"ktlint",
+	"kubeconform",
+	"kube-linter",
+	"chktex",
+	"luacheck",
+	"stylua",
+	"markdownlint",
+	"markdownlint-cli2",
+	"markdown-link-check",
+	"markdown-table-prettify",
+	"remark-lint",
+	"textlint",
+	"vale",
+	"nixpkgs-fmt",
+	"spectral",
+	"sort-package-json",
+	"perlcritic",
+	"perltidy",
+	"php-cs-fixer",
+	"phpcs",
+	"phpstan",
+	"psalm",
+	"oxipng",
+	"psscriptanalyzer",
+	"prisma",
+	"protolint",
+	"buf",
+	"pylint",
+	"flake8",
+	"isort",
+	"ruff",
+	"black",
+	"autopep8",
+	"bandit",
+	"mypy",
+	"pyright",
+	"sourcery",
+	"yapf",
+	"lintr",
+	"opa",
+	"regal",
+	"rubocop",
+	"brakeman",
+	"rufo",
+	"standardrb",
+	"clippy",
+	"rustfmt",
+	"scalafmt",
+	"osv-scanner",
+	"terrascan",
+	"tfsec",
+	"snakemake --lint",
+	"snakefmt",
+	"sqlfluff",
+	"sql-formatter",
+	"sqlfmt",
+	"squawk",
+	"svgo",
+	"stringslint",
+	"swiftformat",
+	"swiftlint",
+	"tflint",
+	"terraform",
+	"tofu",
+	"terragrunt",
+	"txtpbfmt",
+	"taplo",
+	"eslint-plugin-vue",
+	"xmllint",
+	"yamllint"
+];
+//#endregion
 //#region src/utils/atomic-ledger.ts
 /**
 * Small shared primitives for on-disk ledgers: an atomic JSON writer and a
@@ -1048,170 +1212,6 @@ const WIZARD_TOOL_NAMES = {
 	readHandoffs: `mcp__${SERVER_NAME}__read_handoffs`
 };
 //#endregion
-//#region src/utils/custom-headers.ts
-/**
-* Builds a list of custom headers for ANTHROPIC_CUSTOM_HEADERS.
-*/
-function createCustomHeaders() {
-	const entries = [];
-	return {
-		add(key, value) {
-			const name = key.startsWith("x-") || key.startsWith("X-") ? key : `X-${key}`;
-			entries.push({
-				key: name,
-				value
-			});
-		},
-		addFlag(flagKey, variant) {
-			const headerName = POSTHOG_FLAG_HEADER_PREFIX + flagKey.toUpperCase();
-			entries.push({
-				key: headerName,
-				value: variant
-			});
-		},
-		encode() {
-			return entries.map(({ key, value }) => `${key}: ${value}`).join("\n");
-		}
-	};
-}
-//#endregion
-//#region src/lib/safe-tools.ts
-const LINTING_TOOLS = [
-	"codespell",
-	"cspell",
-	"git-diff-check",
-	"gitleaks",
-	"trufflehog",
-	"asl-validator",
-	"ansible-lint",
-	"pmd",
-	"biome",
-	"cfn-lint",
-	"cfnlint",
-	"checkov",
-	"trivy",
-	"test-aztemplate",
-	"shellcheck",
-	"shfmt",
-	"buildifier",
-	"cpplint",
-	"clang-format",
-	"clang-tidy",
-	"cmake-format",
-	"iwyu",
-	"pragma-once",
-	"dotnet-format",
-	"circleci",
-	"clj-kondo",
-	"coffeelint",
-	"commitlint",
-	"jscpd",
-	"stylelint",
-	"prettier",
-	"cue-fmt",
-	"dart",
-	"hadolint",
-	"dotenv-linter",
-	"editorconfig-checker",
-	"actionlint",
-	"zizmor",
-	"gofmt",
-	"gofumpt",
-	"goimports",
-	"gokart",
-	"golangci-lint",
-	"golines",
-	"semgrep",
-	"goreleaser",
-	"graphql-schema-linter",
-	"npm-groovy-lint",
-	"haml-lint",
-	"htmlhint",
-	"djlint",
-	"checkstyle",
-	"google-java-format",
-	"eslint",
-	"next lint",
-	"deno",
-	"rome",
-	"eslint-plugin-jsonc",
-	"eslint-plugin-json",
-	"eslint-plugin-jsx-a11y",
-	"eslint-plugin-react",
-	"nbqa",
-	"detekt",
-	"ktlint",
-	"kubeconform",
-	"kube-linter",
-	"chktex",
-	"luacheck",
-	"stylua",
-	"markdownlint",
-	"markdownlint-cli2",
-	"markdown-link-check",
-	"markdown-table-prettify",
-	"remark-lint",
-	"textlint",
-	"vale",
-	"nixpkgs-fmt",
-	"spectral",
-	"sort-package-json",
-	"perlcritic",
-	"perltidy",
-	"php-cs-fixer",
-	"phpcs",
-	"phpstan",
-	"psalm",
-	"oxipng",
-	"psscriptanalyzer",
-	"prisma",
-	"protolint",
-	"buf",
-	"pylint",
-	"flake8",
-	"isort",
-	"ruff",
-	"black",
-	"autopep8",
-	"bandit",
-	"mypy",
-	"pyright",
-	"sourcery",
-	"yapf",
-	"lintr",
-	"opa",
-	"regal",
-	"rubocop",
-	"brakeman",
-	"rufo",
-	"standardrb",
-	"clippy",
-	"rustfmt",
-	"scalafmt",
-	"osv-scanner",
-	"terrascan",
-	"tfsec",
-	"snakemake --lint",
-	"snakefmt",
-	"sqlfluff",
-	"sql-formatter",
-	"sqlfmt",
-	"squawk",
-	"svgo",
-	"stringslint",
-	"swiftformat",
-	"swiftlint",
-	"tflint",
-	"terraform",
-	"tofu",
-	"terragrunt",
-	"txtpbfmt",
-	"taplo",
-	"eslint-plugin-vue",
-	"xmllint",
-	"yamllint"
-];
-//#endregion
 //#region src/lib/skill-install.ts
 /**
 * Check if command is a PostHog skill installation from MCP.
@@ -1363,6 +1363,35 @@ function writeScanReport() {
 	}
 	return WIZARD_YARA_REPORT_FILE;
 }
+const CATEGORY_DESCRIPTIONS = {
+	prompt_injection: "hit hidden instructions in a file it read, a possible attempt to hijack the setup",
+	exfiltration: "tried to send data to an outside location",
+	destructive_operations: "tried to run a destructive command",
+	supply_chain: "tried to pull in untrusted code",
+	posthog_pii: "tried to write personal data (PII) into your project",
+	posthog_hardcoded_key: "tried to hardcode a PostHog key into your project",
+	hardcoded_secret: "tried to hardcode a secret into your project"
+};
+/** Most recent violation that terminated the run, or null. */
+function lastTerminatingViolation() {
+	for (let i = scanViolations.length - 1; i >= 0; i--) if (scanViolations[i].action === "aborted") return scanViolations[i];
+	return null;
+}
+/**
+* Build the user-facing copy for the security abort screen: what the scanner
+* caught and what we did about it. This screen renders only because the run was
+* stopped, so the "what we did" half is constant. Falls back to a generic line
+* when no specific violation was recorded (e.g. the scanner itself errored and
+* failed closed before a match was logged).
+*/
+function formatYaraAbortMessage() {
+	const v = lastTerminatingViolation();
+	return `Security check stopped the setup.
+
+The agent ${(v && CATEGORY_DESCRIPTIONS[v.category]) ?? "did something our security scanner flagged"}. We stopped the run to keep your project safe.\nNo unsafe changes were left in your project.
+
+If this looks wrong, let us know: wizard@posthog.com`;
+}
 /** Timeout for scan hooks (PreToolUse, PostToolUse Write/Edit/Read/Grep) */
 const HOOK_TIMEOUT_MS = 3e4;
 /** Timeout for the skill install hook (filesystem I/O + multiple scans) */
@@ -2710,8 +2739,8 @@ async function initializeAgent(config, options) {
 	logToFile("Agent initialization starting");
 	logToFile("Install directory:", options.installDir);
 	try {
+		const gatewayUrl = HostResolution.fromApiHost(config.posthogApiHost).gatewayUrl;
 		process.env.CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS = "true";
-		const gatewayUrl = getLlmGatewayUrlFromHost(config.posthogApiHost);
 		process.env.ANTHROPIC_BASE_URL = gatewayUrl;
 		process.env.ANTHROPIC_AUTH_TOKEN = config.posthogApiKey;
 		process.env.CLAUDE_CODE_OAUTH_TOKEN = config.posthogApiKey;
@@ -3042,7 +3071,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 		}
 		if (yaraViolationReason) {
 			logToFile("Agent error: YARA_VIOLATION");
-			spinner.stop("Security violation detected");
+			spinner.stop("Security check stopped the setup");
 			return { error: "WIZARD_YARA_VIOLATION" };
 		}
 		if (abortReason) {
@@ -3085,7 +3114,7 @@ async function runAgent(agentConfig, prompt, options, spinner, config, middlewar
 		signalDone();
 		if (yaraViolationReason) {
 			logToFile("Agent error: YARA_VIOLATION");
-			spinner.stop("Security violation detected");
+			spinner.stop("Security check stopped the setup");
 			return { error: "WIZARD_YARA_VIOLATION" };
 		}
 		if (abortReason) {
@@ -3341,6 +3370,6 @@ function handleSDKMessage(message, options, spinner, signals, receivedSuccessRes
 	}
 }
 //#endregion
-export { getAuditChecks as A, QueueStore as C, AUDIT_REPORT_FILE as D, AUDIT_CHECKS_KEY as E, AUDIT_SEVERITY_STYLE as O, QUEUE_DIR_NAME as S, AUDIT_CHECKS_FILE as T, SETUP_REPORT_FILE as _, runAgent as a, fetchSkillMenu as b, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentSignals as f, EVENT_PLAN_FILE as g, writeScanReport as h, isOrchestratorEnabled as i, coerceAuditChecks as k, recoverOrphanedSettingsBackups as l, formatScanReport as m, buildRunTags as n, backupAndFixClaudeSettings as o, flushScanReport as p, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u, WIZARD_TOOL_NAMES as v, TaskStatus as w, installSkillById as x, downloadSkill as y };
+export { coerceAuditChecks as A, QUEUE_DIR_NAME as C, AUDIT_CHECKS_KEY as D, AUDIT_CHECKS_FILE as E, AUDIT_REPORT_FILE as O, installSkillById as S, TaskStatus as T, EVENT_PLAN_FILE as _, runAgent as a, downloadSkill as b, classifySettingsConflicts as c, sanitizeAgentSubprocessEnv as d, AgentSignals as f, writeScanReport as g, formatYaraAbortMessage as h, isOrchestratorEnabled as i, getAuditChecks as j, AUDIT_SEVERITY_STYLE as k, recoverOrphanedSettingsBackups as l, formatScanReport as m, buildRunTags as n, backupAndFixClaudeSettings as o, flushScanReport as p, initializeAgent as r, checkAllSettingsConflicts as s, buildAgentEnv as t, restoreClaudeSettings as u, SETUP_REPORT_FILE as v, QueueStore as w, fetchSkillMenu as x, WIZARD_TOOL_NAMES as y };
 
-//# sourceMappingURL=agent-interface-BcUv1qeh.js.map
+//# sourceMappingURL=agent-interface-CPn9pZ8j.js.map